What we are reading, and what we reckon.

The NCSC announced Cyber Smart Week 2026 on 30/09/2026. It runs from 5 to 11 October and the theme this year is "Find a scam before it finds you". The NCSC says people are its strongest line of defence and it is using scams as an easy way in to a conversation about the risks people face every day and the habits that protect them.

The asks are the same for a household and a business: learn to recognise suspicious activity and build the habit of checking, back your data up, turn on multi factor authentication, and have a plan for what you do when something goes wrong. For organisations the NCSC is blunt that these are basic preventative measures, not extras.

Jack Clark, one of the founders of Anthropic, told the BBC on 15/09/2026 that an AI kill switch, one a third party can check, may need to be made mandatory. His point was that most labs already have some way to pull the plug, Anthropic included, but that society might want to pass rules about it rather than take anyone's word for it.

The piece lands in the middle of a very public argument. US lawmakers have a Kill Switch Act on the table. The UK government has said no, on the grounds that a switch would not stop the technology being built or misused elsewhere. The US President has called the whole worry a hoax. And people inside the industry are split too, with some saying the fear is overstated or is there to justify the valuations.

Infosecurity Magazine reported on 28/09/2026 on Pindrop's 2026 Deepfake Readiness Index, a survey of security leaders at large US companies. Three quarters of them said they had met, or suspected, a deepfake attack in the past year. Only one in ten said they had tools built for the job. Of the companies that were hit, one in four put the cost of a single incident at a million US dollars or more, and nearly half at half a million or more.

The pattern is not science fiction. Someone clones a familiar face or voice, calls or video calls a staff member as a colleague or the boss, and talks them into a transfer or a password. The report also notes North Korean operators using deepfakes to get hired as remote IT staff. Three quarters of those surveyed admitted the problem would only reach their board once a leader had been fooled in person. Elie Khoury of Pindrop put it plainly: deepfakes turn our most instinctive signals of identity, a familiar face and voice, into an attack surface.

The National Cyber Security Centre published its Cyber Threat Report 2026 on 24/09/2026. It handled 369 incidents of potential national significance in the 2025/26 year. Of those, 162 were linked to criminal or financially motivated actors, up 18 percent on the year before. Four were rated highly significant, which the NCSC says matches the entire previous decade.

The head of the NCSC, Catriona Robinson, said AI is already being used by malicious actors to increase the speed, scale and sophistication of attacks, and the report projects that by early 2027 they may have access to capabilities currently only available through the leading frontier AI models. The report also describes a North Korean IT worker who clandestinely obtained remote IT work with a New Zealand business to earn foreign currency for the state. Robinson's advice to boards and chief executives was to ask whether they have the people, processes and resources to respond to a faster moving threat, and that strong fundamentals remain the best defence against both human and AI enabled attacks.

Fortune reported on 23/09/2026 on McKinsey's look at what companies actually pay for AI. The price of a given level of intelligence has fallen hard: McKinsey's Lari Hämäläinen said intelligence at a certain capability level is getting a lot more affordable, with the 2023 version of GPT-4 having cost sixty US dollars per million output tokens and comparable models now running for a fraction of that.

And yet the bills go up. McKinsey's reasons: businesses use far more of it, agents that reason and retry produce far more output than a person would, and the vendors keep some of the saving as margin. The same task can cost up to thirty times more from one run to the next depending on the path an agent takes. McKinsey's Tanguy Catlin said there is no single cost lever. Their better measure is cost per successful task, including the time a human spends checking the result.

interest.co.nz reported on 22/09/2026 that the Government has extended its AI Advisory Pilot for small businesses by six months, to mid 2027. The pilot co-funds grants of up to $15,000 per business to build an AI roadmap and cover the cost of rolling it out: tool recommendations, setup, integration with what you already run, testing and staff training. Anna Whyte reports that 150 businesses have been through it so far and another 120 are coming on board, which makes 270 in total.

MBIE runs it through the regional business network. Alongside the grants, MBIE has co-funded 256 AI related courses for more than 600 businesses. Minister Cameron Brewer told interest.co.nz that with the right support a local manufacturer, tradie or retailer can use AI to cut the admin and work smarter. Labour announced its own AI policy earlier in the month, with an AI small business fund and an extension of the same pilot, so both sides of the House are backing the idea ahead of the election.

The Government announced on 22/09/2026 that its AI Advisory Pilot is being extended to 30 June 2027, with a further 120 small businesses to get expert help putting AI to work. Around 150 businesses have come on board since it launched in January, according to Small Business and Manufacturing Minister Cameron Brewer.

It runs through the Regional Business Partner Network. A business gets expert advice on where AI can make a real difference, and MBIE co-funds half the cost of a tailored AI roadmap and of putting it in place, capped at $15,000. Mr Brewer said plenty of owners can see AI could save them time and money but do not have the time or in-house expertise to know where to start, and that a local manufacturer, tradie or retailer can use it to cut the admin. The release also notes the network co-funded around 650 businesses onto AI related courses between July 2025 and June 2026.

The NCSC released its SME Cyber Security Behaviour Tracker on 21/09/2026. Across small and medium businesses, 53 percent had experienced some form of cyber incident in the six months before the survey. For businesses with 20 to 49 staff it was 76 percent, and 44 percent of those hit reported a moderate to severe impact: money lost, devices damaged, and stress. The share of SMEs that believe they are vulnerable rose to 43 percent from 34 percent the year before.

The gaps are just as clear. 32 percent of SMEs take no action at all on staff training. A third of the businesses that were hit did not report it, most often because they did not think it was significant or saw no point. AI enabled threats are now the fourth most top of mind concern, with owners worried about AI written scams and deepfakes. Acting Deputy Director General Kevin Moar said AI is making it easier for cyber criminals to carry out attacks and to increase their effectiveness. Cyber Smart Week runs from 5 to 11 October 2026.

Idealog reported on 16/09/2026 on research by Searchable, a London AI search visibility company, that checked 32,556 facts AI assistants gave about 1,704 brands. New Zealand businesses came off worst of the markets measured: 16 percent of the facts about them were false, against a global average of 9 percent. Small firms fared worse than large ones, and 78 percent of the small businesses found at least one mistake among the facts checked.

The errors were the kind that cost you a customer. Assistants invented service offerings, described subscription pricing a studio did not have, credited a skin clinic with membership programmes it did not run, and got practitioner qualifications wrong. Most of it traced back to old information rather than pure invention. Searchable's JP Garbaccio told Idealog the bulk of AI's opinion of a business is formed by press, directories, review sites and forums, and advised owners to check the sources the assistant cites, treat their website as the factual record, add schema mark-up, and keep listings and reviews current.

Tech New Zealand wrote up the Aotearoa AI Summit on 15/09/2026, where business, government, research and innovation leaders met in Wellington. Its one line summary of the week: AI's value is not in the technology alone, it is in the problems we choose to solve, the capability we build and the people we bring with us.

The summit's list of foundations was long and local: resilient infrastructure, strategic data, practical sovereignty, te reo Māori and tikanga, public trust and responsible governance. On the people side, the message was that organisations have to give staff the time, education and support to adapt, and the judgement to know when AI should and should not be used. For marketers the challenge was put plainly: use AI well without losing what makes a brand memorable, which is creativity, emotion, understanding the customer and human connection.

RNZ reported on 10/09/2026 that Thankyou Payroll, a New Zealand payroll company that serves a number of charities, told customers it had been caught in a global breach of a third party reporting tool called Metabase. The company's own systems were not compromised, but the information accessed included names, IRD numbers, email and physical addresses, bank account details and payment histories. Passwords and credit card numbers were not affected. Thankyou Payroll strengthened its protections, asked customers to reset their passwords and notified the Office of the Privacy Commissioner.

Metabase had told its users in August that it had found a critical vulnerability that let an unauthenticated attacker inject SQL into its database and gain administrator access, and had asked them to update as soon as possible. The same month, Mathspace, an online maths platform used in schools across Australia and New Zealand, confirmed that 1,079,819 students, parents, teachers and staff had been affected through the same kind of hole in its own Metabase reporting system.

The NCSC put out an alert on 02/09/2026 about a scam it calls ClickFix. Ordinary, legitimate websites are being compromised so that, shortly after you land on them, a full screen box appears that looks like a Cloudflare "Verify you are human" check, a CAPTCHA or a browser update prompt. Instead of a real check, the page quietly copies a command to your clipboard and tells you to paste it and press enter to continue. Doing that installs infostealer malware, the kind that lifts saved passwords and session cookies from your browser.

The NCSC notes the pages are built to show clean content to automated scanners and the fake prompt only to real people, which is why the sites keep looking safe. Its advice for anyone who has seen one of these prompts: do not run anything copied to your clipboard, run a security scan straight away, reset your passwords and check the device for signs of malware. Website owners who find their site doing this should take it offline, reset their credentials and get an IT professional to clear the code out properly.

The NZ Herald reported on 02/09/2026 that reports to Netsafe of scammers impersonating a bank more than doubled in August, from 21 in July to 46. A third of all scam reports that month, 34 percent, involved someone pretending to be a bank or financial institution, against an average of 20 percent from April to July. At the same time, reports of scammers impersonating government agencies dropped sharply, from an average of 37 a month to 11.

Netsafe's chief online safety officer Sean Lyons said scammers know people are more likely to engage when they believe they are dealing with an organisation they know and trust, and their bank is an obvious choice. His advice is to not respond directly to any unexpected call, text or email that claims to be from your bank: hang up, delete it, and contact the bank on a number you trust. A genuine bank will not mind you checking. Scammers constantly adapt, he said, so the best defence is to slow down, question unexpected contact and verify it independently before doing anything.

Digiday reported on 19/08/2026 that OpenAI's ads business, which began as a pilot in February, has reached 31 European markets after rolling through the US, Canada, Australia, New Zealand, the UK, Mexico, Brazil, Japan and South Korea. ChatGPT is at 900 million weekly users, and OpenAI says around one in five queries shows direct commercial intent, with more upper funnel questions that point to a purchase later.

The mechanics have changed fast. Cost per click bidding is now most of the spend, and the fifty thousand US dollar minimum on the self serve tool has gone. Dave Dugan, OpenAI's ads lead, said the product is designed to help businesses contribute meaningfully when someone decides to take action. Agency people told Digiday the platform barely resembles April's pilot, and one saw it as a way to offset rising Google and Meta costs.